Method and monitoring system for sample-analysis of data comprising a multitute of data packets

A system for a sample-analysis of data comprising a multitude of data packets, the system comprising:

• a classification device classifying the data by classification rules into parent population flow groups, each parent population flow group representing a particular parent population number (N) of data packets,
• a sampling device setting a particular sample number (n) for each of the particular parent population number (N) of data packets,
• the sampling device sampling sample-flow-groups (f1, f2, f3 . . .) with the corresponding sample number (n) of data packets from each of the particular parent population number (N) of data packets, wherein each sample-flow-group (f1, f2, f3 . . .) consists of a sample-flow-quantity (nf1, nf2, nf3 . . .) of data packets that is equal to the respective sample number (n),
• a computing device determining sample-flow-mean-sizes (μf1, μf2, μf3 . . .) defined by mean data size of the data packets in each sample-flow-group (f1, f2, f3 . . .),
• the computing device determining sample-flow-variances (vf1, vf2, vf3 . . .) defined by a variance of data size of the data packets in each sample-flow-group (f1, f2, f3 . . .),
• determining sample-flow-ratios (pf1, pf2, pf3 . . .) defined by the sample-flow-quantity (nf1, nf2, nf3 . . .) in proportion to the sample number (n),
• the computing device calculating an estimated flow size (Sumf) defined by an estimated sum of data sizes of data packages in a flow of a parent population number (N) of data packets, and
• the computing device calculating a variance (V[Sumf]) of the estimated flow size (Sumf), wherein for the calculating steps the parent population number (N), the sample number (n) and at least one of the sample-flow-ratios (pf1, pf2, pf3 . . .), the sample-flow-mean-sizes (μf1, μf2, μf3 . . .), and the sample-flow-variances (vf1, vf2, vf3 . . .) are used, comprising the step of determining at least one of parent population flow-ratios (Pf1, Pf2, Pf3 . . .), parent population flow-mean-sizes (Mf1, Mf2, Mf3 . . .), and parent population flow-variances (Vf1, Vf2, Vf3 . . .) for each flow in the parent population number (N) of data packets, wherein the estimated flow size (Sumf) is defined by
• Sum
• f
• =
• ⁢
• N
• f
• ·
• M
• f
• =
• ⁢
• N
• ·
• p
• f
• ·
• μ
• f
• =
• ⁢
• N
• ·
• n
• f
• n
• ·
• 1
• n
• f
• ·
• ∑
• i
• =
• 1
• n
• f
• ⁢
• x
• f
• ,
• i
• =
• ⁢
• N
• n
• ·
• ∑
• i
• =
• 1
• n
• f
• ⁢
• x
• f
• ,
• i
• and
• Nf denotes a determined number of data packets belonging to one flow f in the parent population number (N) of data packets,
• Mf denotes the determined parent population flow-mean-sizes (Mf1, Mf2, Mf3 . . .),
• μf denotes the sample-flow-mean-sizes (μf1, μf2, μf3 . . .),
• N denotes the parent population number (N),
• pf denotes the sample-flow-ratios (pf1, pf2, pf3 . . .),
• n denotes the sample number (n),
• nf denotes the sample-flow-quantities (nf1, nf2, nf3 . . .) and
• xf denotes the data size of a data packet belonging to one sample-flow-group of the sample-flow-groups (f1, f2, f3 . . .), and
• wherein the variance (V[Sumf]) of the estimated flow size (Sumf) is calculated by
• V
• ⁡
• [
• Sum
• f
• ]
• =
• N
• 2
• n
• ·
• (
• (
• V
• f
• +
• M
• f
• 2
• )
• ·
• P
• f
• -
• M
• f
• 2
• ·
• P
• f
• 2
• )
• and
• Vf corresponds to the determined parent population flow-variances (Vf1, Vf2, Vf3 . . .) and
• Pf denotes the determined parent population flow-ratios (Pf1, Pf2, Pf3 . . .).

A monitoring system for a data network with a data stream comprising a multitude of data packets, wherein the monitoring system comprises:

• at least one input connection for the data stream,
• a sampling device adapted to sample a sample group consisting of a sample number (n) of data packets from a defined parent population number (N) of data packets from the data stream,
• a classification device adapted to classify, by classification rules, the sample group into at least one sample-flow-group (f1, f1, f3 . . .) each of a specific flow and the data stream being included in at least one defined parent population number (N) of data packets each of a specific flow, wherein each sample-flow-group (f1, f2, f3 . . .) consists of a respective sample-flow-quantity (nf1, nf2, nf3 . . .) of data packets, and
• a computing device adapted to calculate an estimated flow size (Sumf) defined by an estimated sum of data sizes of data packages in a flow of the parent population number (N) of data packets and to calculate a variance (V[Sumf]) of the estimated flow size (Sumf), wherein input data for the calculation of the variance of the estimated flow size are the parent population number (N), the sample number (n) and at least one of sample-flow-ratios (pf1, pf2, pf3 . . .) defined by the sample-flow-quantity (nf1, nf2, nf3 . . .) in proportion to the sample number (n), sample-flow-mean-sizes (μf1, μf2, μf3 . . .) defined by mean data size of the data packets in each sample-flow-group (f1, f2, f3 . . .) and sample-flow-variances (vf1, vf2, vf3 . . .) defined by a variance of data size of the data packets in each sample-flow-group (f1, f2, f3 . . .), wherein at least one of parent population flow-ratios (Pf1, Pf2, Pf3 . . .), parent population flow-mean-sizes (Mf1, Mf2, Mf3 . . .), and parent population flow-variances (Vf1, Vf2, Vf3 . . .) for each flow in the parent population number (N) of data packets are determined, wherein the estimated flow size (Sumf) is defined by
• Sum
• f
• =
• ⁢
• N
• f
• ·
• M
• f
• =
• ⁢
• N
• ·
• p
• f
• ·
• μ
• f
• =
• ⁢
• N
• ·
• n
• f
• n
• ·
• 1
• n
• f
• ·
• ∑
• i
• =
• 1
• n
• f
• ⁢
• x
• f
• ,
• i
• =
• ⁢
• N
• n
• ·
• ∑
• i
• =
• 1
• n
• f
• ⁢
• x
• f
• ,
• i
• and
• Nf denotes a determined number of data packets belonging to one flow f in the parent population number (N) of data packets,
• Mf denotes the determined parent population flow-mean-sizes (Mf1, Mf2, Mf3 . . .),
• μf denotes the sample-flow-mean-sizes (μf1, μf2, μf3 . . .),
• N denotes the parent population number (N),
• pf denotes the sample-flow-ratios (pf1, pf2, pf3 . . .),
• n denotes the sample number (n),
• nf denotes the sample-flow-quantities (nf1, nf2, nf3 . . .) and
• xf denotes the data size of a data packet belonging to one sample-flow-group of the sample-flow-groups (f1, f2, f3 . . .), and
• wherein the variance (V[Sumf]) of the estimated flow size (Sumf) is calculated by
• V
• ⁡
• [
• Sum
• f
• ]
• =
• N
• 2
• n
• ·
• (
• (
• V
• f
• +
• M
• f
• 2
• )
• ·
• P
• f
• -
• M
• f
• 2
• ·
• P
• f
• 2
• )
• and
• Vf corresponds to the determined parent population flow-variances (Vf1, Vf2, Vf3 . . .) and
• Pf denotes the determined parent population flow-ratios (Pf1, Pf2, Pf3 . . .).

A system for a sample-analysis of data comprising a multitude of data packets, the system comprising:

• an input of a monitoring system receiving from a network data from which a parent population number (N) of data packets is provided,
• a sampling device setting a sample number (n),
• the sampling device sampling a sample group with the sample number (n) of data packets from the parent population number (N) of data packets,
• a classification device classifying the sample group by classification rules into sample-flow-groups (f1, f2, f3 . . .) representing different flows, each sample-flow-group (f1, f2, f3 . . .) consisting of a sample-flow-quantity (nf1, nf2, nf3 . . .) of data packets,
• a computing device determining sample-flow-mean-sizes (μf1, μf2, μf3 . . .) defined by mean data size of the data packets in each sample-flow-group (f1, f2, f3 . . .),
• the computing device determining sample-flow-variances (vf1, vf2, vf3 . . .) defined by a variance of data size of the data packets in each sample-flow-group (f1, f2, f3 . . .),
• determining sample-flow-ratios (pf1, pf2, pf3 . . .) defined by the sample-flow-quantity (nf1, nf2, nf3 . . .) in proportion to the sample number (n),
• the computing device calculating an estimated flow size (Sumf) defined by an estimated sum of data sizes of data packages in a flow of the parent population number (N) of data packets, and
• the computing device calculating a variance (V[Sumf]) of the estimated flow size (Sumf), wherein for the calculating steps the parent population number (N), the sample number (n) and at least one of the sample-flow-ratios (pf1, pf2, pf3 . . .), the sample-flow-mean-sizes (μf1, μf2, μf3 . . .), and the sample-flow-variances (vf1, vf2, vf3 . . .) are used, comprising the step of determining at least one of parent population flow-ratios (Pf1, Pf2, Pf3 . . .), parent population flow-mean-sizes (Mf1, Mf2, Mf3 . . .), and parent population flow-variances (Vf1, Vf2, Vf3 . . .) for each flow in the parent population number (N) of data packets, wherein for each sample-flow-group (f1, f2, f3 . . .) in a further step a sample-flow-size (sf1, sf2, sf3 . . .), defined by a sum of bytes of the sample-flow-quantity (nf1, nf2, nf3 . . .) of data packets, and a sample-square-sum (sqf1, sqf2, sqf3 . . .), defined by summing up respective squared bytes of the sample-flow-quantity (nf1, nf2, nf3 . . .) of data packets, are calculated, stored and updated, and wherein the parent population flow-variances (Vf1, Vf2, Vf3 . . .) are calculated using the sample-flow-size (sf1, sf2, sf3 . . .) and the sample-square-sum (sqf1, sqf2, sqf3 . . .) of a flow size in the formula
• V
• f
• =
• 1
• n
• f
• ⁢
• sq
• f
• -
• 1
• n
• f
• 2
• ⁢
• s
• f
• 2
• wherein
• nf denotes the sample-flow-quantities (nf1, nf2, nf3 . . .) of data packets of a flow,
• sf denotes the sample-flow-size (sf1, sf2, sf3 . . .) of a flow and
• sqf denotes the sample-square-sum (sqf1, sqf2, sqf3 . . .) of the flow size.

A system for a sample-analysis of data comprising a multitude of data packets, the system comprising:

• a classification device classifying the data by classification rules into parent population flow groups, each parent population flow group representing a particular parent population number (N) of data packets,
• a sampling device setting of a particular sample number (n) for each of the particular parent population number (N) of data packets,
• the sampling device sampling sample-flow-groups (f1, f2, f3 . . .) with the corresponding sample number (n) of data packets from each of the particular parent population number (N) of data packets, wherein each sample-flow-group (f1, f2, f3 . . .) consists of a sample-flow-quantity (nf1, nf2, nf3 . . .) of data packets that is equal to the respective sample number (n),
• a computing device determining sample-flow-mean-sizes (μf1, μf2, μf3 . . .) defined by mean data size of the data packets in each sample-flow-group (f1, f2, f3 . . .),
• the computing device determining sample-flow-variances (vf1, vf2, vf3 . . .) defined by a variance of data size of the data packets in each sample-flow-group (f1, f2, f3 . . .),
• determining sample-flow-ratios (pf1, pf2, pf3 . . .) defined by the sample-flow-quantity (nf1, nf2, nf3 . . .) in proportion to the sample number (n),
• the computing device calculating an estimated flow size (Sumf) defined by an estimated sum of data sizes of data packages in a flow of a parent population number (N) of data packets, and
• the computing device calculating a variance (V[Sumf]) of the estimated flow size (Sumf), wherein for the calculating steps the parent population number (N), the sample number (n) and at least one of the sample-flow-ratios (pf1, pf2, pf3 . . .), the sample-flow-mean-sizes (μf1, μf2, μf3 . . .), and the sample-flow-variances (vf1, vf2, vf3 . . .) are used, comprising the step of determining at least one of parent population flow-ratios (Pf1, Pf2, Pf3 . . .), parent population flow-mean-sizes (Mf1, Mf2, Mf3 . . .), and parent population flow-variances (Vf1, Vf2, Vf3 . . .) for each flow in the parent population number (N) of data packets, wherein for each sample-flow-group (f1, f2, f3 . . .) in a further step a sample-flow-size (sf1, sf2, sf3 . . .), defined by a sum of bytes of the sample-flow-quantity (nf1, nf2, nf3 . . .) of data packets, and a sample-square-sum (sqf1, sqf2, sqf3 . . .), defined by summing up respective squared bytes of the sample-flow-quantity (nf1, nf2, nf3 . . .) of data packets, are calculated, stored and updated, and wherein the parent population flow-variances (Vf1, Vf2, Vf3 . . .) are calculated using the sample-flow-size (sf1, sf2, sf3 . . .) and the sample-square-sum (sqf1, sqf2, sqf3 . . .) of a flow size in the formula
• V
• f
• =
• 1
• n
• f
• ⁢
• sq
• f
• -
• 1
• n
• f
• 2
• ⁢
• s
• f
• 2
• wherein
• nf denotes the sample-flow-quantities (nf1, nf2, nf3 . . .) of data packets of a flow,
• sf denotes the sample-flow-size (sf1, sf2, sf3 . . .) of a flow and
• sqf denotes the sample-square-sum (sqf1, sqf2, sqf3 . . .) of the flow size.